Dropbox stated that they could not access your data ("employees aren't able"), which was simply and obviously just false. They mumbled and backpedaled and said "ok well employees can access you're data, they're just not allowed to". Instead of an immediate retraction saying their previous statements were invalid and obviously a mistake, they tried to justify it and blame users for being confused.

Dropbox also had a deploy that disabled password checking. As in, anyone could log into any account because passwords weren't checked. I suppose that's understandable - people make mistakes and sometimes you deploy things you shouldn't.